Privacy Policy — SENDPath

SENDPath ("we", "us", "our") is committed to protecting your privacy. This policy explains the limited personal data involved when you visit sendpath.uk ("the Site"), contact us, appear in the directory, or communicate with us in a professional capacity.

We aim to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The temporary controller-identification limitation below is stated openly rather than hidden.

1. Who we are

Temporary controller-identification notice: SENDPath is the public trading name used for this independent UK information website; it is not presented as a registered company. The operator's full legal identity is not yet published. This notice therefore does not currently satisfy the UK GDPR requirement to identify the controller. Disabling optional services reduces personal-data processing but does not remove that requirement. The legal identity will be added later. Until then, optional analytics, interaction tracking, newsletter sign-ups, contact forms, listing submissions, and listing claims are disabled. For privacy enquiries or rights requests, contact hello@sendpath.uk.

2. What data we collect

a) Data you give us directly

Free EHCP template: no name or email address is required to download it.
Website forms and newsletters: these are temporarily disabled and collect no information.
Email: if you choose to email us, we receive your email address and the information in your message so we can deal with the request.

Please do not email names, health information, medical details, or other sensitive personal information about a child.

b) Data collected automatically

Hosting and security logs: Vercel, our hosting provider, may process IP address, request, browser, and device information needed to deliver and protect the Site.
No optional analytics: Google Analytics, Ahrefs Analytics, download measurement, and affiliate-click measurement are disabled. No SENDPath analytics identifier is created.
Local browser data: saved providers, tool inputs, and reading history may be stored only in your browser so local features work. Letter-generator inputs can include family details and remain on that device until you use the tool's clear-all control or clear this Site's browser storage. SENDPath does not receive those inputs.

c) Directory and professional-contact data

Directory records: a provider or professional listing may include a person's name, professional role, publicly advertised business contact details, service area, website, services, and the public source used to check those details.
Sources: listing information is researched from provider websites, professional directories, regulator or public-body records, NHS or local-authority information, and other sources that are already publicly accessible.
Corrections and objections: we may retain the substance and date of a provider's correction, removal request, objection, or claim so that we can keep the directory accurate and respect future contact preferences.
Historical outreach records: earlier provider-contact records may include a professional email address, organisation, message date, delivery status, and reply. New outbound provider marketing is paused during the privacy hold while those records, the lawful basis, and the electronic-marketing rules are reviewed.

Public availability does not make information free of data-protection obligations. Where directory or professional-contact information identifies a person, the rights and safeguards in this policy apply to it.

3. How we use your data

To respond when you voluntarily send an essential correction or privacy request by email — legal basis: legitimate interests or, where applicable, compliance with a legal obligation.
To deliver, secure, and prevent abuse of the Site — legal basis: legitimate interests.
To research, publish, check, and correct useful directory information — legal basis: legitimate interests in maintaining an accurate public-interest SEND directory, balanced against the rights of the person named.
To record objections and suppress further contact — legal basis: compliance with data-protection and electronic-marketing obligations and our legitimate interests in respecting those choices.

We do not use visitor or provider information for profiling or automated decision-making. Visitor analytics, newsletter marketing, and new outbound provider marketing are disabled while this temporary privacy hold is active.

4. Cookies, local storage, and analytics

Optional analytics and interaction measurement are fully disabled during the temporary privacy hold. The Site does not request Google Analytics, create a GA identifier, or save an analytics-consent choice. The privacy-control script also removes an earlier SENDPath analytics choice and first-party GA cookies when possible.

Local tools: some tools deliberately store your work only on your device. This supports the feature and is not used to track you across websites.
External affiliate sites: SENDPath does not set an Amazon cookie while you browse this Site. If you follow an Amazon affiliate link, you leave SENDPath and Amazon may process the visit under its own Privacy Notice.

5. Third-party processors

Vercel Inc. — hosts and delivers the Site and processes associated security and request logs. Vercel Privacy Notice ↗
ImprovMX — forwards messages sent voluntarily to hello@sendpath.uk to the receiving mailbox. ImprovMX Privacy Policy ↗
Google (Gmail) — provides the receiving mailbox used for SENDPath correspondence and replies to earlier provider outreach. Google Privacy Policy ↗
Resend — was used to deliver earlier provider outreach. New outbound provider marketing is paused, but Resend may retain earlier delivery records under its service terms. Resend Privacy Policy ↗

International processing: Vercel, ImprovMX, Google, and Resend may process information outside the UK. Vercel's data-processing terms incorporate UK transfer provisions. ImprovMX states that its services may process information in the United States and Europe. Resend publishes a data-processing addendum for its email service. See the linked provider information, the Vercel DPA, and the Resend DPA.

6. Disabled services

Formspree submissions, Buttondown newsletter sign-ups, Google Analytics, Ahrefs Analytics, download measurement, affiliate-click measurement, and new outbound provider marketing are disabled. Downloading the free EHCP template does not subscribe you or send an analytics event. Affiliate links remain clearly marked; following one takes you to an external retailer under that retailer's privacy terms.

7. Data retention

Email corrections and privacy requests: normally retained for up to six months after the request is resolved, unless a longer period is needed for a legal obligation or dispute.
Directory information: retained while the listing remains relevant and reasonably current, then corrected, archived, or removed following review or a valid request.
Provider-contact working records: reviewed within 12 months of the last contact and then deleted or reduced to the minimum needed to document a correction, dispute, or contact objection.
Suppression records: the minimum identifier needed to respect an objection or opt-out is retained for as long as it is reasonably needed to prevent further contact.
Tool inputs saved in your browser: retained on that device until you use the feature's clear control or clear this Site's browser storage; SENDPath does not receive those inputs.
Hosting and security logs: retained according to Vercel's service and security retention settings.

8. Your rights under UK GDPR

You have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — ask us to delete your data ("right to be forgotten").
Restriction — ask us to restrict processing of your data.
Data portability — where this right applies, receive relevant data in a machine-readable format.
Object — object to processing based on legitimate interests.
Withdraw consent — where processing is based on consent, you can withdraw it at any time.

If you are named in a directory listing, you can also ask where the information came from, request a correction, object to the use of your personal data, or ask for removal. To exercise any of these rights, contact us at hello@sendpath.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

9. Children's privacy

SENDPath is a directory resource for parents and carers of disabled children. Our forms are not intended for children to submit personal data, and we ask adults not to submit names, medical details, or other sensitive personal information about a child. If you are under 18, please use this Site with the guidance of a parent or carer.

10. External links

Our directory and guides link to external websites, including schools, services, organisations, and retailers such as Amazon. Those sites are responsible for their own data practices. Review their privacy information before providing data.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the Site. The "Last updated" date at the top of this page will reflect any changes.

12. Contact

For any privacy-related queries: hello@sendpath.uk